VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information disclosure, privilege escalation and other security issues.

               VMware Security Advisory

     Extended support &#40;Security and Bug fixes&#41; for ESX 3.0.2 ends
     on 10/29/2008 and Extended support for ESX 3.0.2 Update 1
     ends on 8/8/2009.  Users should plan to upgrade to ESX 3.0.3
     and preferably to the newest release available.

     Extended Support &#40;Security and Bug fixes&#41; for ESX 3.0.1 has
     ended on 2008-07-31.  The 3.0.1 patches are released in
     August because there was no patch release in July.

  Starting from this release, VMware has set the killbit on its
  ActiveX controls. Setting the killbit ensures that ActiveX
  controls cannot run in Internet Explorer &#40;IE&#41;, and avoids
  security issues involving ActiveX controls in IE. See the
  Microsoft KB article 240797 and the related references on this
  topic.

  Security vulnerabilities have been reported for ActiveX controls
  provided by VMware when run in IE. Under specific circumstances,
  exploitation of these ActiveX controls might result in denial-of-
  service or can allow running of arbitrary code when the user
  browses a malicious Web site or opens a malicious file in IE
  browser. An attempt to run unsafe ActiveX controls in IE might
  result in pop-up windows warning the user.

  Note: IE can be configured to run unsafe ActiveX controls without
        prompting.  VMware recommends that you retain the default
        settings in IE, which prompts when unsafe actions are
        requested.

  Earlier, VMware had issued knowledge base articles, KB 5965318 and
  KB 9078920 on security issues with ActiveX controls. To avoid
  malicious scripts that exploit ActiveX controls, do not enable
  unsafe ActiveX objects in your browser settings. As a best
  practice, do not browse untrusted Web sites as an administrator
  and do not click OK or Yes if prompted by IE to allow certain
  actions.

  VMware would like to thank Julien Bachmann, Shennan Wang, Shinnai,
  and Michal Bucko for reporting these issues to us.

  The Common Vulnerabilities and Exposures Project &#40;cve.mitre.org&#41;
  has assigned the names CVE-2008-3691, CVE-2008-3692,
  CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, CVE-2007-5438, and
  CVE-2008-3696 to the security issues with VMware ActiveX controls.

  VMware         Product   Running  Replace with/
  Product        Version   on       Apply Patch
  =============  ========  =======  =================
  VirtualCenter  any       Windows  not affected

  Workstation    6.x       Windows  6.0.5 build 109488 or later
  Workstation    6.x       Linux    not affected
  Workstation    5.x       Windows  5.5.8 build 108000 or later
  Workstation    5.x       Linux    not affected

  Player         2.x       Windows  2.0.5 build 109488 or later
  Player         2.x       Linux    not affected
  Player         1.x       Windows  1.0.8 build  or later
  Player         1.x       Linux    not affected

  ACE            2.x       Windows  2.0.5 build 109488 or later
  ACE            1.x       Windows  1.0.7 build 108880 or later

  Server         1.x       Windows  1.0.7 build 108231 or later
  Server         1.x       Linux    not affected

  Fusion         1.x       Mac OS/X not affected

  ESXi           3.5       ESXi     not affected

  ESX            any       ESX      not affected

  The Internet Server Application Programming Interface &#40;ISAPI&#41; is
  an API that extends the functionality of Internet Information
  Server &#40;IIS&#41;. VMware uses ISAPI extensions in its Server product.

  One of the ISAPI extensions provided by VMware is vulnerable to a
  remote denial of service. By sending a malformed request, IIS
  might shut down. IIS 6.0 restarts automatically. However, IIS 5.0
  does not restart automatically when its Startup Type is set to
  Manual.

  VMware would like to thank the Juniper Networks J-Security
  Security Research Team for reporting this issue to us.

  The Common Vulnerabilities and Exposures Project &#40;cve.mitre.org&#41;
  has assigned the name CVE-2008-3697 to this issue.

  VMware         Product   Running  Replace with/
  Product        Version   on       Apply Patch
  =============  ========  =======  =================
  VirtualCenter  any       Windows  not affected

  Workstation    6.x       Windows  not affected
  Workstation    6.x       Linux    not affected
  Workstation    5.x       Windows  not affected
  Workstation    5.x       Linux    not affected

  Player         2.x       Windows  not affected
  Player         2.x       Linux    not affected
  Player         1.x       Windows  not affected
  Player         1.x       Linux    not affected

  ACE            2.x       Windows  not affected
  ACE            1.x       Windows  not affected

  Server         1.x       Windows  1.0.7 build 108231 or later
  Server         1.x       Linux    not affected

  Fusion         1.x       Mac OS/X not affected

  ESXi           3.5       ESXi     not affected

  ESX            any       ESX      not affected

  This release fixes a privilege escalation vulnerability in host
  systems.  Exploitation of this vulnerability allows users to run
  arbitrary code on the host system with elevated privileges.

  VMware would like to thank Sun Bing from McAfee, Inc. for
  reporting this issue to us.

  The Common Vulnerabilities and Exposures Project &#40;cve.mitre.org&#41;
  has assigned the name CVE-2008-3698 to this issue.

  VMware         Product   Running  Replace with/
  Product        Version   on       Apply Patch
  =============  ========  =======  =================
  VirtualCenter  any       Windows  not affected

  Workstation    6.x       Windows  not affected
  Workstation    6.x       Linux    not affected
  Workstation    5.x       Windows  5.5.8 build 108000 or later
  Workstation    5.x       Linux    not affected

  Player         2.x       Windows  not affected
  Player         2.x       Linux    not affected
  Player         1.x       Windows  1.0.8 build 109488 or later
  Player         1.x       Linux    not affected

  ACE            2.x       Windows  not affected
  ACE            1.x       Windows  1.0.7 build 108880 or later

  Server         1.x       Windows  1.0.7 build 108231 or later
  Server         1.x       Linux    not affected

  Fusion         1.x       Mac OS/X not affected

  ESXi           3.5       ESXi     not affected

  ESX            any       ESX      not affected

  FreeType 2.3.6 resolves an integer overflow vulnerability and other
  vulnerabilities that can allow malicious users to run arbitrary code
  or might cause a denial-of-service after reading a maliciously
  crafted file. This release updates FreeType to 2.3.7.

  The Common Vulnerabilities and Exposures Project &#40;cve.mitre.com&#41;
  has assigned the names CVE-2008-1806, CVE-2008-1807, and
  CVE-2008-1808 to the issues resolved in Freetype 2.3.6.

  VMware         Product   Running  Replace with/
  Product        Version   on       Apply Patch
  =============  ========  =======  =================
  VirtualCenter  any       Windows  not affected

  Workstation    6.x       Windows  not affected
  Workstation    6.x       Linux    6.0.5 build 109488 or later
  Workstation    5.x       Windows  not affected
  Workstation    5.x       Linux    5.5.8 build 108000 or later

  Player         2.x       Windows  not affected
  Player         2.x       Linux    2.0.5 build 109488 or later
  Player         1.x       Windows  not affected
  Player         1.x       Linux    1.0.8 build 108000 or later

  ACE            2.x       Windows  not affected
  ACE            1.x       Windows  not affected

  Server         1.x       Windows  not affected
  Server         1.x       Linux    1.0.7 build 108231 or later

  Fusion         1.x       Mac OS/X affected, patch pending

  ESXi           3.5       ESXi     not affected

  ESX            3.5       ESX      not affected
  ESX            3.0.3     ESX      not affected
  ESX            3.0.2     ESX      not affected
  ESX            3.0.1     ESX      not affected
  ESX            2.5.5     ESX      affected, patch pending
  ESX            2.5.4     ESX      affected, patch pending

  Cairo 1.4.12 resolves an integer overflow vulnerability that can
  allow malicious users to run arbitrary code or might cause a
  denial-of-service after reading a maliciously crafted PNG file.
  This release updates Cairo to 1.4.14.

  The Common Vulnerabilities and Exposures &#40;cve.mitre.com&#41; has
  assigned the name CVE-2007-5503 to this issue.

  VMware         Product   Running  Replace with/
  Product        Version   on       Apply Patch
  =============  ========  =======  =================
  VirtualCenter  any       Windows  not affected

  Workstation    6.x       Windows  not affected
  Workstation    6.x       Linux    6.0.5 build 109488 or later
  Workstation    5.x       Windows  not affected
  Workstation    5.x       Linux    not affected

  Player         2.x       Windows  not affected
  Player         2.x       Linux    2.0.5 build 109488 or later
  Player         1.x       Windows  not affected
  Player         1.x       Linux    not affected

  ACE            2.x       Windows  not affected
  ACE            1.x       Windows  not affected

  Server         1.x       Windows  not affected
  Server         1.x       Linux    not affected

  Fusion         1.x       Mac OS/X affected, patch pending

  ESXi           3.5       ESXi     not affected

  ESX            any       ESX      not affected

  VMware Consolidated Backup command-line utilities accept the user
  password through the -p command-line option. Users logged into the
  service console could gain access to the username and password used
  by VCB command-line utilities when such commands are running.

  This patch resolves this issue by providing an alternative way of
  passing the password used by VCB command-line utilities.

  The following options are recommended for passing the password:

  1. The password is specified in /etc/backuptools.conf
  &#40;PASSWORD=xxxxx&#41;, and -p is not used in the command line.
  /etc/backuptools.conf file permissions are read/write only
  for root.

  2. No password is specified in /etc/backuptools.conf and the
  -p option is not used in the command line. The user will be
   prompted to enter a password.

  ESX is not affected unless you use VCB.

  The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
  has assigned the name CVE-2008-2101 to this issue.

  VMware         Product   Running  Replace with/
  Product        Version   on       Apply Patch
  =============  ========  =======  ===================
  VirtualCenter  any       Windows  not affected

  hosted *       any       any      not affected

  ESXi           3.5       ESXi     not affected

  ESX            3.5       ESX      ESX350-200806203-UG
  ESX            3.0.3     ESX      ESX303-200808403-SG
  ESX            3.0.2     ESX      ESX-1004824
  ESX            3.0.1     ESX      ESX-1004823
  ESX            2.5.5     ESX      not affected
  ESX            2.5.4     ESX      not affected

  * hosted products are VMware Workstation, Player, ACE, Server, Fusion

  Several flaws were discovered in the way third party library
  libpng handled various PNG image chunks. An attacker could
  create a carefully crafted PNG image file in such a way that
  it causes an application linked with libpng to crash when the
  file is manipulated.

  The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
  has assigned the name CVE-2007-5269 to this issue.

  NOTE: There are multiple patches required to remediate the issue.

  VMware         Product   Running  Replace with/
  Product        Version   on       Apply Patch
  =============  ========  =======  ===================
  VirtualCenter  any       Windows  not affected

  hosted *       any       any      not affected

  ESXi           3.5       ESXi     affected, patch pending

  ESX            3.5       ESX      affected, patch pending
  ESX            3.0.3     ESX      ESX303-200808404-SG
                                    ESX303-200808403-SG
  ESX            3.0.2     ESX      ESX-1005109 ESX-1005114 ESX-1005113
  ESX            3.0.1     ESX      ESX-1005112 ESX-1005108 ESX-1005111
  ESX            2.5.5     ESX      affected, patch pending
  ESX            2.5.4     ESX      affected, patch pending

  * hosted products are VMware Workstation, Player, ACE, Server, Fusion

  This update upgrades the service console rpms for bind-utils and
  bind-lib to version 9.2.4-22.el3.

  Version 9.2.4.-22.el3 addresses the recently discovered
  vulnerability in the BIND software used for Domain Name
  resolution &#40;DNS&#41;. VMware doesn&#39;t install all the BIND packages
  on ESX Server and is not vulnerable by default to the reported
  vulnerability. Of the BIND packages, VMware only ships bind-util
  and bind-lib in the service console and these components by
  themselves cannot be used to setup a DNS server. Bind-lib and
  bind-util are used in client DNS applications like nsupdate,
  nslookup, etc.

  VMware explicitly discourages installing applications like BIND
  on the service console. In case the customer has installed BIND,
  and the DNS server is configured to support recursive queries,
  their ESX Server system is affected and they should replace BIND
  with a patched version.

  Note: ESX Server will use the DNS server on the network it is
  on, so it is important to patch that DNS server.

  The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
  has assigned the name CVE-2008-1447 to this issue.

  VMware         Product   Running  Replace with/
  Product        Version   on       Apply Patch
  =============  ========  =======  ===================
  VirtualCenter  any       Windows  not affected

  hosted *       any       any      not affected

  ESXi           3.5       ESXi     not affected

  ESX            3.5       ESX      patch pending
  ESX            3.0.3     ESX      ESX303-200808406-SG
  ESX            3.0.2     ESX      ESX-1006356
  ESX            3.0.1     ESX      ESX-1005117
  ESX            2.5.5     ESX      patch pending
  ESX            2.5.4     ESX      patch pending

  * hosted products are VMware Workstation, Player, ACE, Server, Fusion

VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information disclosure, privilege escalation and other security issues.

VMware Workstation 6.0.5

VMware Workstation 5.5.8

VMware Player 2.0.5 and 1.0.8

VMware ACE 2.0.5

VMware ACE 1.0.7

VMware Server 1.0.7

ESX

VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information disclosure, privilege escalation and other security issues.

VMware Workstation 6.0.5

VMware Workstation 5.5.8

VMware Player 2.0.5 and 1.0.8

VMware ACE 2.0.5

VMware ACE 1.0.7

VMware Server 1.0.7

ESX

Related